CVE-2026-100378 in MediaWiki Translate Extension
Summary
by MITRE • 09/25/2026
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Mediawiki - Translate Extension: from * before 1.46.1, 1.45.5, 1.43.10.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The Wikimedia Foundation's MediaWiki platform, specifically the Translate extension, contains a critical access control vulnerability that allows unauthorized users to execute administrative functions intended for privileged accounts. This flaw stems from an insufficient enforcement of Access Control Lists (ACLs) within the translation management interface. In typical web application architectures, authorization checks must be performed on every request to ensure that only authenticated and authorized entities can perform specific actions. However, in this instance, certain endpoints related to managing translation units or configuring extension settings do not adequately verify whether the requesting user possesses the necessary permissions before processing the action. This represents a classic case of broken access control where the server trusts client-side inputs or session states without rigorous backend validation against defined role-based policies.
From a technical perspective, this vulnerability falls under CWE-285: Improper Authorization and is often associated with CWE-639: Injection of Critical Data into an Access Control Decision if the lack of authorization check allows for further exploitation vectors such as cross-site scripting or data manipulation. The Translate extension facilitates collaborative translation efforts by allowing users to manage message keys, review translations, and configure language-specific settings. When these administrative capabilities are accessible without proper constraints, any authenticated user with a basic account can potentially modify system configurations, alter translation databases, or disrupt the integrity of localized content. This undermines the fundamental security principle that privileges should be granted on a need-to-know basis, ensuring that users only have access to resources and functions directly relevant to their assigned roles.
The operational impact of this vulnerability is significant for any instance relying on MediaWiki for multilingual support. Attackers can exploit this flaw to deface websites by injecting malicious content into translation strings, which may then be displayed across multiple language versions depending on the site's configuration. Furthermore, an attacker could escalate privileges within the application context if other components rely on the same flawed authorization logic. This could lead to a complete compromise of the wiki instance, allowing for data exfiltration, denial of service through resource exhaustion via malicious translation submissions, or persistent backdoors being installed in extension configurations. For high-profile wikis like those hosted by Wikimedia Foundation, such an issue poses reputational risks and potential compliance violations regarding data integrity and availability standards.
Mitigation strategies must prioritize immediate patching to the latest stable versions where this flaw has been addressed. Administrators should upgrade MediaWiki and the Translate extension to version 1.46.1 or later, 1.45.5, or 1.43.10 as specified in the vendor advisory. In environments where upgrading is not immediately feasible, temporary mitigations include restricting access to the translation management interface through web server configuration rules that limit IP ranges to trusted administrative networks only. Additionally, implementing strict input validation and ensuring that all backend API calls perform explicit authorization checks against user roles can provide a layer of defense in depth. Security teams should also monitor logs for unusual patterns of activity related to translation unit modifications or configuration changes initiated by low-privilege accounts to detect potential exploitation attempts early. Regular audits of access control policies across all extensions are recommended to prevent similar misconfigurations from occurring elsewhere in the application stack.